Description
Solaris 9, when configured as a Kerberos client with patch 112908-12 or 115168-03 and using pam_krb5 as an "auth" module with the debug feature enabled, records passwords in plaintext, which could allow local users to gain other user's passwords by reading log files.
References
- 10606 vdb-entry
- O-172 third-party-advisory government-resource
- 101519 vendor-advisory
- oval:org.mitre.oval:def:2065 vdb-entry signature
- oval:org.mitre.oval:def:255 vdb-entry signature
- 11940 third-party-advisory
- solaris-kerberos-password-plaintext(16450) vdb-entry
- VU#523710 third-party-advisory
- 57587 vendor-advisory